201210260019 123whg

explained decrypted filler

3DES(name+title) ECB, 9 GUIDs, seed 600

Metadata

Post ID: 123whg
Title: 201210260019 → 2012-10-26 00:19 on A858's clock
Posted (UTC): 2012-10-26 04:19:14
Timezone: UTC−4 · title 00:19 against posted 04:19 UTC
Author: [deleted]
Account: A858DE45F56D9BC9 main account
Subreddit: r/A858DE45F56D9BC9 the main subreddit
Category: F3 filler: 3DES(name/title) → GUID list, seed known
Size: 592 hex characters · 296 bytes
Cipher: 3DES-EDE2 (two-key Triple DES), ECB, PKCS7
Key: MD5(A858DE45F56D9BC9201210260019) = cb35c95435fdfe9933d4d5f4907f401f (name+title)
New here: Missing from the community archive; decrypted here for the first time. (new results)
GUIDs: 9
Filler GUID seed: new Random(600).Next(9) ✓ verified
Run: Run 38 (seed 1,045,884,937) (seed)
Draw: 23 · predicted N = 9 ✓
Machine boot: 2012-10-11 03:41–03:51 (seed = uptime at app start)
Sources: arctic-shift · body from arctic-shift
Links: Reddit · Arctic Shift · JSON
Score · comments: 0 · 0
Tags: automated (decryptable)2012Encrypted masked GUID listarctic-onlykey: name+titlerun: seed

From the post to its content

As posted (encrypted)

385D34A922CCE817 49F2EACD1526A440 D78C7AC47C5D4BF7 901274B220283EC8 883E548B1CA53A84 7A2347042192C10F 5210D6A9E9D86A05 D219207A0DFAA1E5 78454459C5D9ACF0 6BC15BF0A33DDF7F F1E80C2F92697936 A06FC7B39679DC7B 6DA09368A04F216F 939FB68817AF4D16 F11FD97A71915AB4 519DE9F19838E1CB A7E4CD67A149EC9A 88D6D60EC2A8CAE1 6D69F92092FA20BF 6A09EE8BD94D69D4 9A5A686E45FCD60F E4F5D42EEF50F413 C496F2FF8AB61F06 2C73B3006F3012BD 453E6644113BD4B9 7DE6799026D3B8F7 00AAD87AE3FC86FC CCB0355A053C1341 F18D834A6403D76F 731E23E841D1B2C1 634BEE807EEB71C8 F226E58055FC1820 3A3380C7AEC5B15D DB7BDFE7650B7200 448A4F26FBB43828 38BC270202034864 B15F94A8B312B976

Read the ciphertext. Strip whitespace: 592 hex characters = 296 bytes = 37 8-byte 3DES blocks.
Derive the key. Password = A858DE45F56D9BC9201210260019 (name+title). Key = MD5(password) = cb35c95435fdfe9933d4d5f4907f401f, used as a two-key 3DES key.
Decrypt. 3DES-EDE2 in ECB mode, then strip the PKCS7 padding. The plaintext is 9 GUIDs as hex (shown below).

Decrypted: GUID list

  1 58100129-1e41-180a-8f8a-0182938e1e9c
  2 00434f51-b93e-77e8-a418-b6116719250a
  3 0ac5c13f-d924-1c08-87a0-19b081fe313a
  4 bdfd0028-2965-52ee-9701-35b6ba2b1d12
  5 50102c28-0b45-0a9c-bce2-f071f8bba71e
  6 5398ea52-ab18-84b4-bbb6-dd1938c3d08d
  7 9969e8f8-ed89-6fda-8f40-aeb899288a5f
  8 81fa9dc0-a653-4d7e-be64-4a825d639362
  9 28f8927f-9038-192e-86e7-64b4e8d2228c

Explanation

Explain the mask digits. The version nibble (13th hex digit) of each GUID, read in order, gives 171508641. Exactly this sequence comes out of new Random(600).Next(9): the per-post millisecond seed of the mask generator. The other 30 hex digits of each GUID are Guid.NewGuid() output and carry no message.
Explain the count. This post is draw 23 of Run 38 (seed 1,045,884,937): new Random(1045884937), Next(8,64) per post. The RNG predicts N = 9; the post has N = 9 ✓. The seed is the machine's uptime in ms when the app started (boot 2012-10-11 03:41–03:51).
Conclusion. Filler. The content is fully explained by the two RNGs.

Metadata

From the post to its content

As posted (encrypted)

Decrypted: GUID list

Explanation

Related